https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-23523.htmlhttps://patchthecve.com/cve/CVE-2026-23523.htmlWed, 17 Jun 2026 10:21:43 +0000CRITICAL 9.6: Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim’https://patchthecve.com/cve/CVE-2025-66580.htmlhttps://patchthecve.com/cve/CVE-2025-66580.htmlWed, 17 Jun 2026 09:57:03 +0000CRITICAL 9.6: Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary JavaScrhttps://patchthecve.com/cve/CVE-2025-58176.htmlhttps://patchthecve.com/cve/CVE-2025-58176.htmlWed, 17 Jun 2026 09:44:00 +0000HIGH 8.8: Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click Remote Code Execution vulnerability triggered through a custom url value, `transport` in the JSON object. An attacker can exploit the vulnera